Memory Analysis

The memory analysis capability in Cerbero Suite offers an integrated, self-contained, and state-of-the-art visual solution for examining Windows memory dumps. It is powered entirely by technology built by Cerbero Labs and does not rely on external frameworks such as Volatility. The feature is delivered through the Memory Analysis package, which is available to all Cerbero Suite customers through Cerbero Store.

Our memory analysis capabilities continue to grow, so the best way to get acquainted with the solution is through our CTF videos. Below you will find them arranged with the most recent entries first.

Memory Challenge 10: Mellitus

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to Hack The Box for creating it in the first place.

The scenario is as follows:

"You've been a SOC analyst for the last 4 years but you've been honing your incident response skills! It’s about time you bite the bullet and go for your dream job as an Incident Responder as that’s the path you’d like your career to follow. Currently you are going through the interview process for a medium size incident response internal team and the cocky interviewing responder has given you a tough technical challenge to test your memory forensics aptitude. Can you get all the questions right and secure the job?"

The challenge contains multiple questions. We identified the suspicious process, how it was downloaded, the attacker's IP, the FTP login attempts and the last visited webpage from the history of Google Chrome.

Memory Challenge 9: BankingTroubles

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place.

The scenario is as follows:

"Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an e-mail from a co-worker that pointed to a PDF file. Upon opening, the employee did not notice anything; however, they recently had unusual activity in their bank account.

The initial theory is that a user received an e-mail, containing an URL leading to a forged PDF document. Opening that document in Acrobat Reader triggers a malicious Javascript that initiates a sequence of actions to take over the victim's system.

Company X was able to obtain a memory image of the employee's virtual machine upon suspected infection and asked you as a security blue team analyst to analyze the virtual memory and provide answers to the questions."

The challenge contains multiple questions, but the most interesting one asks you to extract the final payload from the shellcode embedded in the PDF's JavaScript.

Memory Challenge 8: MemLabs Lab 4 - Obsession

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to MemLabs for creating it in the first place.

The description is as follows:

"My system was recently compromised. The Hacker stole a lot of information but he also deleted a very important file of mine. I have no idea on how to recover it. The only evidence we have, at this point of time is this memory dump. Please help me.

Note: This challenge is composed of only 1 flag.

The flag format for this lab is: inctf{s0me_l33t_Str1ng}"

Although this challenge is rated as medium difficulty, it took us only a minute to solve, thanks to the file scan action.

Memory Challenge 7: DeepDive

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place.

The scenario is as follows:

"You have given a memory image for a compromised machine. As a security blue team analyst Analyze the image and figure out attack details."

Thanks to our newly introduced feature for detecting hidden processes, this challenge turns out to be quite simple. We identify the malware family using two separate methods. First, we dump the malicious process to disk and submit it to VirusTotal. Second, we locate an injected PE within the memory of the malicious process and analyze it. The YARA signature match once again confirms the malware family.

Memory Challenge 6: Injector

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place.

The scenario is as follows:

"A company’s web server has been breached through their website. Our team arrived just in time to take a forensic image of the running system and its memory for further analysis. As a soc analyst, you are tasked with mounting the image to determine how the system was compromised and the actions/commands the attacker executed."

While there are many questions to answer in this CTF challenge, we focus on extracting the shellcode from the Apache logs. One particularly cool aspect of this challenge is that Cerbero Suite can handle both the analysis of the memory dump and the mounting of the NTFS partition to inspect the logs within the same workspace.

Memory Challenge 5: DumpMe

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place.

The scenario is as follows:

"A SOC analyst took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions."

While there are many questions to be answered in this CTF challenge, we limit ourselves to extracting the flag from the user-mode memory of the Notepad process.

Memory Challenge 4: Remember Me

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberTalents for creating it in the first place. The challenge can be downloaded directly from here.

The scenario is as follows:

"After acquiring memory from attacker pc we found there is no internet browser except internet explorer. Can you get internet history?"

Memory Challenge 3: Invisible

In this case, after observing the presence of a PDF viewer process, we mined the user memory of that process for PDF documents and found one. When opened in a PDF viewer, the PDF displays only one image; however, it contains a second image...

Memory Challenge 2: MEM Challenge

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to the BlackHat MEA Team for creating it in the first place. The challenge can be downloaded directly from here.

The scenario is as follows:

"My work PC has suddenly crashed. I can no longer retrieve my secret file, also I don’t remember the password. It is a hard password and securely generated, but I saved it locally. Can you help me recover the content?"

Although it's not commonly done, examining the registry keys for installed software can be useful. On virtual machines prepared for CTF challenges, there's usually only software related to the challenge. This was also the case here: we noticed the presence of WinRAR and checked the user key associated with it to look for recent archives. There, we indeed found a file of interest.

Memory Challenge 1: Reveal

The challenge was created by the CyberDefenders team and can be downloaded from their website.

The scenario is as follows:

"You are a forensic investigator at a financial institution, and your SIEM flagged unusual activity on a workstation with access to sensitive financial data. Suspecting a breach, you received a memory dump from the compromised machine. Your task is to analyze the memory for signs of compromise, trace the anomaly's origin, and assess its scope to contain the incident effectively."

The final question of the challenge is to identify the malware family, which is what we demonstrate in the video.

Memory Analysis

What is the Memory Analysis package?

Which platforms and Windows versions are supported?

Which memory dump formats are supported?

Does the solution rely on external frameworks such as Volatility?

Is the solution suitable for both malware analysis and forensics?

Can I use it to compare findings with other tools?

Is the solution scriptable through the SDK?

What is the development state of the solution?

Is the Memory Analysis package included with Cerbero Suite?

Does the solution support visual analysis?

Can the tool handle corrupted dumps or partially damaged memory images?

Memory Analysis

Frequently Asked Questions